Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/php-luasandbox-3.0.3/alloc.c
Examining data/php-luasandbox-3.0.3/data_conversion.c
Examining data/php-luasandbox-3.0.3/library.c
Examining data/php-luasandbox-3.0.3/luasandbox.c
Examining data/php-luasandbox-3.0.3/luasandbox_lstrlib.c
Examining data/php-luasandbox-3.0.3/luasandbox_timer.h
Examining data/php-luasandbox-3.0.3/luasandbox_types.h
Examining data/php-luasandbox-3.0.3/luasandbox_version.h
Examining data/php-luasandbox-3.0.3/php_luasandbox.h
Examining data/php-luasandbox-3.0.3/timer.c

FINAL RESULTS:

data/php-luasandbox-3.0.3/data_conversion.c:247:17:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
			key_length = snprintf(buffer, sizeof(buffer), "%" PRId64, (int64_t)lkey);
data/php-luasandbox-3.0.3/data_conversion.c:278:17:  [4] (format) snprintf:
  If format strings can be influenced by an attacker, they can be exploited,
  and note that sprintf variations do not always \0-terminate (CWE-134). Use
  a constant for the format specification.
			size_t len = snprintf(buffer, sizeof(buffer), "%" PRId64, (int64_t)lkey);
data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:780:3:  [4] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused).
  strcpy(form + l - 1, LUA_INTFRMLEN);
data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:807:11:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
          sprintf(buff, form, (int)luaL_checknumber(L, arg));
data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:812:11:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
          sprintf(buff, form, (LUA_INTFRM_T)luaL_checknumber(L, arg));
data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:817:11:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
          sprintf(buff, form, (unsigned LUA_INTFRM_T)luaL_checknumber(L, arg));
data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:822:11:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
          sprintf(buff, form, (double)luaL_checknumber(L, arg));
data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:840:13:  [4] (format) sprintf:
  Potential format string problem (CWE-134). Make format string constant.
            sprintf(buff, form, s);
data/php-luasandbox-3.0.3/data_conversion.c:215:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char buffer[MAX_LENGTH_OF_LONG + 1];
data/php-luasandbox-3.0.3/luasandbox.c:307:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(&luasandbox_object_handlers, zend_get_std_object_handlers(), sizeof(zend_object_handlers));
data/php-luasandbox-3.0.3/luasandbox.c:310:2:  [2] (buffer) memcpy:
  Does not check for buffer overflows when copying to destination (CWE-120).
  Make sure destination can always hold the source data.
	memcpy(&luasandboxfunction_object_handlers, zend_get_std_object_handlers(), sizeof(zend_object_handlers));
data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:800:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char form[MAX_FORMAT];  /* to store the format (`%...') */
data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:801:7:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
      char buff[MAX_ITEM];  /* to store the formatted item */
data/php-luasandbox-3.0.3/timer.c:230:9:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	static char buffer[1024];
data/php-luasandbox-3.0.3/timer.c:303:2:  [2] (buffer) char:
  Statically-sized arrays can be improperly restricted, leading to potential
  overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
  functions that limit length, or ensure that the size is larger than the
  maximum possible length.
	char prof_name[prof_name_size];
data/php-luasandbox-3.0.3/library.c:252:35:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			luasandbox_allowed_globals[i], strlen(luasandbox_allowed_globals[i]) + 1,
data/php-luasandbox-3.0.3/library.c:256:35:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
			luasandbox_allowed_globals[i], strlen(luasandbox_allowed_globals[i]), &zv);
data/php-luasandbox-3.0.3/luasandbox.c:671:7:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		if (strlen(p.chunkName) != chunkNameLength) {
data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:770:3:  [1] (buffer) strncpy:
  Easily used incorrectly; doesn't always \0-terminate or check for invalid
  pointers [MS-banned] (CWE-120).
  strncpy(form, strfrmt, p - strfrmt + 1);
data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:778:14:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
  size_t l = strlen(form);
data/php-luasandbox-3.0.3/luasandbox_lstrlib.c:849:33:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
      luaL_addlstring(&b, buff, strlen(buff));
data/php-luasandbox-3.0.3/timer.c:296:26:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	size_t prof_name_size = strlen(ar->short_src)
data/php-luasandbox-3.0.3/timer.c:299:21:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
		prof_name_size += strlen(name);
data/php-luasandbox-3.0.3/timer.c:313:4:  [1] (buffer) strcpy:
  Does not check for buffer overflows when copying to destination [MS-banned]
  (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
  easily misused). Risk is low because the source is a constant character.
			strcpy(prof_name, "?");
data/php-luasandbox-3.0.3/timer.c:329:26:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	uint key_length = (uint)strlen(prof_name) + 1;
data/php-luasandbox-3.0.3/timer.c:339:19:  [1] (buffer) strlen:
  Does not handle strings that are not \0-terminated; if given one it may
  perform an over-read (it could cause a crash if unprotected) (CWE-126).
	ZSTR_LEN(zstr) = strlen(prof_name);

ANALYSIS SUMMARY:

Hits = 26
Lines analyzed = 5816 in approximately 0.14 seconds (42179 lines/second)
Physical Source Lines of Code (SLOC) = 4141
Hits@level = [0]   5 [1]  11 [2]   7 [3]   0 [4]   8 [5]   0
Hits@level+ = [0+]  31 [1+]  26 [2+]  15 [3+]   8 [4+]   8 [5+]   0
Hits/KSLOC@level+ = [0+] 7.48611 [1+] 6.27868 [2+] 3.62231 [3+] 1.9319 [4+] 1.9319 [5+]   0
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.